Mailgun Webhooks Skill

When to Use This Skill

• Setting up Mailgun webhook handlers
• Verifying Mailgun webhook signatures (HMAC-SHA256 over timestamp + token)
• Debugging Mailgun signature verification failures
• Handling email delivery events: delivered, failed, opened, clicked
• Handling list events: unsubscribed, complained
• Distinguishing permanent vs temporary failures via the severity field
• Verifying subaccount webhooks via the optional parent-signature field

How Mailgun Webhooks Differ

Unlike most providers, Mailgun puts the signature inside the request body, not in a header. The webhook payload always has this shape:

{
  "signature": {
    "timestamp": "1529006854",
    "token": "a8ce0edb2dd8301dee6c2405235584e45aa91d1e9f979f3de0",
    "signature": "d2271d12299f6592d9d44cd9d250f0704e4674c30d79d07c47a66f95ce71cf55"
  },
  "event-data": { "event": "delivered", "...": "..." }
}

Verify by computing HMAC-SHA256(signing_key, timestamp + token) and comparing the hex digest to signature.signature using timing-safe equality.

Essential Code (USE THIS)

Node.js — Verify Signature

const crypto = require('crypto');

function verifyMailgun(signature, signingKey) {
  // signature is the `signature` object from the request body
  const { timestamp, token, signature: providedSig } = signature;

  if (!timestamp || !token || !providedSig) return false;

  const expected = crypto
    .createHmac('sha256', signingKey)
    .update(timestamp + token)  // concatenate, no separator
    .digest('hex');

  // Timing-safe comparison
  try {
    return crypto.timingSafeEqual(
      Buffer.from(expected, 'hex'),
      Buffer.from(providedSig, 'hex')
    );
  } catch {
    return false;  // length mismatch
  }
}

Express Webhook Handler

const express = require('express');
const crypto = require('crypto');

const app = express();

app.post('/webhooks/mailgun', express.json(), (req, res) => {
  const { signature, 'event-data': eventData } = req.body;

  if (!signature || !verifyMailgun(signature, process.env.MAILGUN_WEBHOOK_SIGNING_KEY)) {
    return res.status(400).json({ error: 'Invalid signature' });
  }

  switch (eventData.event) {
    case 'delivered':
      console.log('Delivered:', eventData.recipient);
      break;
    case 'failed':
      // severity: 'permanent' (hard bounce) or 'temporary' (soft bounce)
      console.log(`Failed (${eventData.severity}):`, eventData.recipient);
      break;
    case 'opened':
      console.log('Opened:', eventData.recipient);
      break;
    case 'clicked':
      console.log('Clicked:', eventData.url);
      break;
    case 'unsubscribed':
    case 'complained':
      console.log(`${eventData.event}:`, eventData.recipient);
      break;
  }

  res.json({ received: true });
});

Python (FastAPI) Webhook Handler

import hmac, hashlib, os
from fastapi import FastAPI, Request, HTTPException

app = FastAPI()
SIGNING_KEY = os.environ["MAILGUN_WEBHOOK_SIGNING_KEY"]

def verify_mailgun(sig: dict) -> bool:
    timestamp = sig.get("timestamp", "")
    token = sig.get("token", "")
    provided = sig.get("signature", "")
    expected = hmac.new(
        SIGNING_KEY.encode(),
        (timestamp + token).encode(),
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, provided)

@app.post("/webhooks/mailgun")
async def mailgun_webhook(request: Request):
    body = await request.json()
    signature = body.get("signature")
    if not signature or not verify_mailgun(signature):
        raise HTTPException(status_code=400, detail="Invalid signature")

    event_data = body.get("event-data", {})
    # handle event_data["event"]...
    return {"received": True}

For complete working examples with tests, see:

• examples/express/ - Full Express implementation
• examples/nextjs/ - Next.js App Router implementation
• examples/fastapi/ - Python FastAPI implementation

Common Event Types

For the full event reference, see Mailgun Events documentation.

Environment Variables

# HTTP Webhook Signing Key from Mailgun dashboard
# (Sending → API Keys → HTTP webhook signing key)
MAILGUN_WEBHOOK_SIGNING_KEY=your-signing-key-here

The signing key is the same for account-level and domain-level webhooks — both use the HTTP Webhook Signing Key from your Mailgun account.

Account-Level vs Domain-Level Webhooks

Mailgun lets you configure webhooks two ways:

• Account-level — webhook fires for events across all sending domains on the account. Configure under Sending → Webhooks at the account level.
• Domain-level — webhook fires only for events on a specific sending domain. Configure under Sending → Webhooks → [domain].

Both use the same signature scheme and the same Webhook Signing Key. Pick whichever fits your routing — the handler code is identical.

Subaccount parent-signature

If you use Mailgun subaccounts, payloads from a subaccount may include an extra parent-signature field alongside signature. The parent-signature is signed with the parent account's signing key. If you receive subaccount webhooks at a parent-account endpoint, verify parent-signature using the parent's signing key.

Replay Protection

The token field is a one-time 50-character random string. Cache seen tokens (e.g., in Redis with a TTL) and reject duplicates to drop replays:

if (await redis.exists(`mg:${signature.token}`)) {
  return res.status(200).send('Duplicate');  // 200 so Mailgun stops retrying
}
await redis.setex(`mg:${signature.token}`, 86400, '1');  // 24h TTL

Optionally reject very stale timestamps (e.g., > 1 hour old), but stay lenient — Mailgun retries can lag.

Local Development

# Start tunnel (no account needed)
npx hookdeck-cli listen 3000 mailgun --path /webhooks/mailgun

Reference Materials

• references/overview.md — Mailgun webhook concepts, full event catalog
• references/setup.md — Dashboard configuration, getting the signing key
• references/verification.md — Signature verification details and gotchas